PT-2026-27456 · Unknown · Lollms-Webui

Regaan · Publicado 2026-03-24 · Atualizado 2026-04-14 · CVE-2026-33340

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions LoLLMs WEBUI (affected versions not specified)

Description LoLLMs WEBUI, the web user interface for Lord of Large Language and Multi modal Systems, contains a Server-Side Request Forgery (SSRF) issue. An unauthenticated attacker can exploit this to force the server to make arbitrary GET requests via the /api/proxy endpoint. This could allow access to internal services, scanning of local networks, and potential exfiltration of sensitive cloud metadata, such as AWS or GCP IAM tokens.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Missing Authentication

Enumeração de Fraquezas

CWE-918

CWE-306

Identificadores relacionados

CVE-2026-33340

Produtos afetados

Lollms-Webui

Referências · 8

• 🔥 https://github.com/ParisNeo/lollms-webui/security/advisories/GHSA-mcwr-5469-pxj4 · Exploit
• https://github.com/ParisNeo/lollms-webui/blob/8c5dcef63d847bb3d027ec74915d8fe4afd3014e/lollms/server/endpoints/lollms_apps.py#L443-L450 · Nota
• https://twitter.com/TheHackerWire/status/2036536515938095350 · Publicação no Twitter
• https://twitter.com/pdnuclei_bot/status/2044143687693893849 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2036482991073956072 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2036505762080628868 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33340 · Nota de Segurança
• https://twitter.com/CveFindCom/status/2036498945266913735 · Publicação no Twitter